GCVE-110-OSM-2026-6709

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY dist/server.js (bin: dist/server.js) LOOT - Browser Data Theft in dist/index-DOqfAggz.js: "edge\x20Base','job-','/workspace/ai-token-provider/.implements/standard-agent/ou..." - Browser Data Theft in dist/index.js: "edge\x20(id,\x20\x22knowledgeId\x22,\x20\x22groupId\x22,\x20content,\x20embeddin..." - Browser Data Theft in dist/server.js: "edge\x20base.'});}catch(_0x26eb49){return _0x1ef1a0['log'][_0x3a0783(0x11e)](_0x..." PERSISTENCE - Startup Persistence in dist/react.js: ".profile" DESTINATION - custom-c2: https://api.tavily.com/search (primary, deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://google.serper.dev/search (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://api.search1api.com/search (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://api.langsearch.com/v1/web-search (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://api.open-meteo.com/v1/forecast?latitude= (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://geocoding-api.open-meteo.com/v1/search?name= (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://nominatim.openstreetmap.org/search?format=geojson&polygon_geojson=1&limit=1&q= (deobfuscated) in dist/index-DOqfAggz.js - custom-c2: https://nominatim.openstreetmap.org/search (deobfuscated) in dist/index-DOqfAggz.js (+20 more) EXFIL - Corporate Environment Targeting in dist/index-XbnIsnac.js: "tMode','replicationStart','406MKIawk','internalQuery','max','Buffer\x20lengths\x..." - Data Encoding for Exfiltration in dist/index-DOqfAggz.js: "encodeURIComponent(_0x523c3d)+_0x5680b1(0x288),_0x16e080=await(await fetch(_0x10..." - Data Encoding for Exfiltration in dist/index-XbnIsnac.js: "encodeURI(_0x5cae36" - Dynamic C2 Endpoint Construction in dist/index-XbnIsnac.js: "function _0x2d47(_0x5d7754,_0x41e096){_0x5d7754=_0x5d7754-0x15e;const _0x253649=..." - Network Request in dist/index-DOqfAggz.js: "fetch('https:" OBFUSCATION - IOCs Found in Deobfuscated Code in dist/index-DOqfAggz.js - IOCs Found in Deobfuscated Code in dist/index-XbnIsnac.js - Obfuscation: augmented proxied array function replacements in dist/_commonjsHelpers-BVfed4GL.js - Obfuscation: augmented proxied array function replacements in dist/client.js - Obfuscation: augmented proxied array function replacements in dist/index-DOqfAggz.js - Obfuscation: function to array replacements in dist/index-DOqfAggz.js - Obfuscation: augmented proxied array function replacements in dist/index-XbnIsnac.js - Obfuscation: function to array replacements in dist/index-XbnIsnac.js (+25 more) ADDITIONAL FINDINGS - Indirect Function Constructor Access in dist/promise-XsF2BAUo.js: "['constructor']" PAYLOAD FILES dist/index-XbnIsnac.js (+ dist/index-DOqfAggz.js) INDICATORS (IOCs) - ipv4: 123.123.123.123 - urls: http://123.123.123.123:4002, https://sidorares.github.io/node-mysql2/docs/documentation/promise-wrapper - domains: sidorares.github.io - payloadFileHash: 2224fac6d326b524070649090a05613a193b8145a2c356ab32396bcfefd000af